<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Insecure Login</title>
<link rel="stylesheet" type="text/css" href="formate.css">
</head>
<body>
<p><b>Lesson Plan Title:</b>Insecure Login</p>

<p><b>Concept / Topic To Teach:</b><br/>
Sensitive data should never sent in plaintext! 
Often applications switch to a secure connection after the authorization. 
An attacker could just sniff the login and use the gathered information 
to break into an account. A good webapplication always takes care of 
encrypting sensitive data.
</p> 

<p><b>General Goal(s):</b><br/>
See how easy it is to sniff a password in plaintext. <br>
Understand the advantages of encrypting the login data! 
</p>

<b>Solution:</b><br/>
<p>This lesson has two stages. In the first stage you try to sniff a password
which is sent in plaintext. In the second stage you try the same
but on a secure connection.</p>
<p>You need a client server setup for this lesson. Please refer
to the Tomcat Setup in the Introduction section.</p>

<b>Stage 1</b>
<p>Start a sniffer. If you do not have one we recommend wireshark, which 
is free: <a href="http://www.wireshark.org/"> Wireshark</a>. Make sure 
you are capturing on the right interface. Click on
the submit button ans stop the capturing. Now analyze the captured data.</p>
<div align="left">
<img src="InsecureLogin_files/wireshark1.png"><br>
<font size="2"> <b>Figure 1: Sniffed Traffic</b></font>
</div>
<p>As you can see we are interested in the HTTP Post request as
the password is transmitted there. The field for the password has
the name clear_pass and has as value sniffy. Of course
this is also the correct answer and you are done with stage 1.</p>

<b>Stage 2</b>
<p>
Now you have to switch to a secure connection. You archive this
by changing the URL from http://... to https://... Sniff again the traffic
as you have done in stage 1. As you will see there is not sent the password
in plaintext. The server communicates with the application over a secure layer
the so called Transport Layer Security (TLS) also called Secure Socket Layer (SSL).
TLS is a hybrid encrypting protocol. A master secret is built to communicate.
This master secret is built by using SHA-1 and MD5. All traffic between 
the Server and the Cleint is encrypted.</p>





</body>
</html>